Privacy Policy

Last updated: October 15, 2026

Introduction

EpitomeRx, Inc. ("EpitomeRx," "we," "our," or "us") values your privacy and is committed to protecting your information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website or interact with us online (the "Services").

This Privacy Policy applies only to information collected through our website and related communications. It does not replace our Notice of Privacy Practices, which governs how we use and protect protected health information under the HIPAA Privacy Rule.

Scope of this policy

This policy applies to information collected:

• Through our website
• Through email, text, or other electronic communications with us
• Through forms or features available on our website

This policy does not apply to:

• Information collected offline or by phone
• Information collected through third-party websites not controlled by EpitomeRx

Information we collect

Information you provide directly. We may collect information you voluntarily provide, including:

• Name
• Email address
• Phone number
• Mailing address
• Information submitted through contact forms or inquiries
• Your email address, if you join the Nº 29 waitlist

Automatically collected information. When you visit our website, our hosting provider automatically records basic technical information needed to deliver and secure the site, such as:

• IP address
• Browser type and device information
• Pages requested and the date and time of the request
• General geographic location (city/state level) based on IP address

How we use your information

We use information collected through our website to:

• Respond to inquiries and communicate with you
• Provide information about our pharmacy services
• Improve website performance and user experience
• Maintain security and prevent misuse of our site
• Comply with applicable legal obligations

We do not use personal health information collected through HIPAA-regulated processes for marketing purposes.

Cookies and tracking technologies

Our website does not use advertising cookies or analytics tracking. It may use a small number of technical cookies or browser storage that are needed for the site to work (for example, to remember that you closed a notice, or to keep an approved prescriber signed in to the prescriber portal).

Our Contact page includes an embedded Google Map. When that page loads, Google may set its own cookies and collect information about your visit, including over time and across other websites, under Google's Privacy Policy. We do not control those cookies.

You may block or delete cookies through your browser settings; however, certain features of the website, such as the embedded map, may not work properly.

Our website does not respond to Do Not Track browser signals. Other than the embedded Google Map described above, we do not allow third parties to collect personal information about your online activities over time and across different websites when you use our site.

Third-party services

We use a limited number of third-party providers to run our website:

• Website hosting and security, which delivers the site and keeps the technical logs described above
• A form-processing service, which receives what you type into our contact or waitlist forms and emails it to us
• Google Maps, for the map on our Contact page
• An email delivery service, which sends prescriber portal sign-in codes and access emails

These providers have access only to the information needed to perform their functions. Our website also links to our pages on Google, Yelp and LinkedIn; those sites are governed by their own privacy policies.

We do not control third-party websites or services and are not responsible for their privacy practices. Purchases made through third-party stores, such as Fullscript or our payment processor, are governed by those companies' terms and privacy policies.

Sharing of information

We do not sell your personal information.

We may share information:

• With service providers who assist in operating our website
• To comply with legal obligations or regulatory requests
• To protect the rights, safety, or property of EpitomeRx, our patients, or others

Prescriber portal

Our prescriber portal is for licensed prescribers and their office staff. When you request access, we collect your name, credentials, practice name, email address and phone number, and the prescriber's NPI (or California veterinary license number). We check the NPI against the public NPI Registry, and our pharmacist reviews each request.

To sign in, we email a one-time code to your address. After you sign in, a secure cookie keeps you signed in on that device for up to one year or until you sign out. We keep a list of approved users, with the date each was approved and last signed in, so we can manage access.

We use this information only to run the portal and to contact you about your access. We do not sell or share it. To be removed from the portal, contact us.

Email and the Nº 29 waitlist

If you join the Nº 29 waitlist, we use your email address only to tell you about the Nº 29 launch and related EpitomeRx skincare updates. Every email includes a way to unsubscribe, or you can contact us to be removed. We do not share or sell waitlist addresses.

Data security

We use reasonable administrative, technical, and physical safeguards to protect information collected through our website. However, no internet transmission or storage system can be guaranteed to be completely secure. You should avoid submitting sensitive health information through unsecured website forms or email.

Data retention

We retain personal information only as long as necessary to:

• Fulfill the purposes outlined in this policy
• Comply with legal and regulatory obligations
• Resolve disputes and enforce agreements

Children's privacy

Our website is not intended for individuals under the age of 13, and we do not knowingly collect personal information from children.

Your rights and choices

Depending on your state of residence, you may have rights regarding your personal information, including:

• Requesting access to your information
• Requesting correction of inaccurate data
• Requesting deletion of certain information

To make a request, please contact us using the information below.

Communications disclaimer

Please note that email and website forms may not be secure. Avoid sending sensitive health or confidential information through these channels. For matters involving prescriptions or personal health information, please contact us directly by phone.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised effective date.

Contact information

If you have questions about this Privacy Policy or our practices, please contact:

Privacy Officer
EpitomeRx, Inc.
140 E Santa Clara St, Ste 23
Arcadia, CA 91006
626.631.6150
[email protected]

Important notice

For information on how we use and disclose protected health information, please review our Notice of Privacy Practices (HIPAA).